Device Classification for Mac - Netskope Technical Documentation

You can classify Mac devices based on these criteria:

Criteria match: Checks for All or Any of the criteria selected.
Encryption check: Checks for FileVault drive encryption and/or PGP drive encryption.
OPSWAT check: Checks for basic compliance or full compliance.
Process check: Checks for specified processes, like Chrome.exe.
File check: Checks for specified files, like file.txt. You must include the absolute path and filename, for example, /Users/username/Documents/file.txt.
AD Domain check: Checks for AD domains, like company.localGroup.
AV check: Checks the running status of the selected anti-virus product.
OS check: Checks the OS version compliance.
Certificate check: Checks for the specified certificate on the device.
You can use your own certificates or the certificates downloaded from the Netskope UI (refer to Trusted Certificates).
The certificate file must have a specific structure and be in PEM format. The Intermediate and Root certificates need to be combined into a single PEM file. The order of those two certs in that PEM file must be Intermediate first, and then Root below it.

Create Device Classification Rule for Versions From 127.0.0 Or Later

Earlier, the Device Classification Rules webUI provided only the Match Any or Match All operators to choose between criteria in a Device Classification rule. With the release of version 127.0.0, Netskope extends the support for the usage of logical operators AND/OR between criteria in a Device Classification rule.

The logical operators work at three levels in a Device Classification Rule:

Apply logical operators globally across all Criteria Groups within a device classification rule.
Apply logical operators within a Criteria Group.
Apply logical operators within certain criteria such as:
- File and Process
- File OR Process

To create a device classification rule for Mac:

Go to Settings > Manage > Device Classification.
Select Mac on the New Device Classification dropdown list.
Follow these steps to classify your Mac device. Select options and enter the requested parameters.
- Rule Name: Enter a name for this classification rule.
- Device Classification: From the options displayed in the dropdown menu, choose the desired label you want to assign to this rule. You cannot assign more than one label to a rule.
- Classification Criteria: In Add Criteria Group, select one of the following options:
  
  You can create up to 16 criteria groups within a device classification rule.
- Encryption: To classify a device to be encrypted, choose one or both of these options:
  - FileVault
  - PGP
- OPSWAT: Netskope can leverage OPSWAT capabilities (You need to install OPSWAT to use its capabilities) to identify the applications installed on the endpoint device and monitor them. To use an OPSWAT check, select one of the following from the Check Type dropdown menu and enter the Metaccess license key:
  - Full Compliance check: Netskope Client checks whether the MetaAccess agent is running to ensure that registry contains the latest compliance information. Also, check if the configured MetaAccess license on the WebUI matches the product license.
  - Basic Compliance check: Checks if the compliance policy check has a critical error. In case of an error, the basic compliance check fails.
- Process: To classify a managed device based on the presence of any one or more processes. To enter the executable file name(s), click +Process and add the process names in the format text1.exe. You can add up to 16 process names.
- File: To classify a device based on the presence of one or more files. To enter the file name, click +FIle and add the file name in the format Sample.txt. You can add up to 16 file names.
- AD Domains: To classify a device associated with any one or more domains, enter the domain name.
- Certificate: To look for certificates on the device. This section also displays the existing certificates.
  
  Netskope Client uses certificate issuer (complete cert chain) that the administrator imports into the webUI, to verify the client certificate signed by the import certificate.
  
  Prepare a Device Classification Certificate Rule
  
  To upload a new certificate, click Select File, and then upload your certificate in Base-64 encoded .pem format. If you have multiple signing certificates to upload, you need to create multiple device classification rules for each certificate. For example, to upload CA-Certificate-A and CA-Certificate-B, create separate device classification rules: DC-Cert-Rule-A with CA-Certificate-A and DC-Cert-Rule-B with CA-Certificate-B. The new certificate added in each rule do not replace the previously added certificates in other rules. However, if you choose to replace an existing certificate, the new certificate replaces the previous one within the same rule.
  
  Ensure that each PEM file begins with BEGIN CERTIFICATE and ends with END CERTIFICATE.
  
  A single PEM file can be a combination of the following:
  - Intermediate CA certificate
  - Root CA certificate
  It is important to add certificates in the correct sequence in the certificate chain starting with Intermediate CA that issued the client certificate followed by the Root CA.
  
  A correct PEM file is in the following format:
  
  Begins with
  
  —–BEGIN CERTIFICATE—–
  
  Ends with:
  
  —–END CERTIFICATE—–
  
  Upload CA Certificates
  
  Refer to the following examples to understand which CA certificates you need to upload in the webUI.
  - Example 1: Client Cert is signed by Root CA
    - Upload Root CA .pem file
  - Example 2: Client Cert is signed by Intermediate CA
    - Upload a single .pem file which contains Intermediate and Root CA
    - Order of the certs in the file should be Intermediate CA followed by Root CA
  - Example 3: Client Cert is signed by Intermediate CA-2
    
    Intermediate CA-2 is signed by Intermediate CA-1
    
    Intermediate CA-1 is signed by Root CA
    - Upload a single .pem file which contains Int CA-2, Int CA-1 and Root CA
    - Order of the certs in the file should be Int CA-2, Int CA-1, Root CA
  Additional Certificate Check Options
  - Check UPN: This check compares the current logged in UserPrincipalName with four fields present in the certificate: Subject CN, Subject Email, Subject Alternative RFC822, and Subject Alternative Principal Name. If any of these four fields match with the current login principal name, then the UPN Check is successful.
  - Check Private Key is Non-Exportable: This option adds an additional layer of security and verifies if the certificate’s private key is exportable. If the Non-Exportable Private Key setting is enabled the device is labelled as Unmanaged if the private key is exportable. If the private key is not exportable, device is labelled as Managed.
    
    In case you do not select this option, it is easier to bypass the certificate check rule by copying a valid user certificate from a managed device to an unmanaged device and effectively causing the unmanaged device to be treated as managed.
  - Check CRL: This option checks if the certificate is revoked.
    
    Prerequisites:
    - Your certificate status must be OK for the entire certificate chain.
    - Your certificate must include a CRL Distribution Point URL.